The development of machine/deep learning methods has led to breakthrough performance in various areas of application. However, some recent research revealed that these powerful but delicate models are vulnerable to random perturbation and adversarial attacks. For example, well-designed malicious adversarial input may induce wrong decision making when filtering junk emails or detecting malicious binary programs [1]}, [2]}. On the other hand, by studying adversarial samples, one can in turn improve adversarial robustness of algorithms in practice. The existing literature focus on generating adversarial samples, e.g., [3]}, [2]}, adversarial training, e.g., [5]}, [6]}, [7]}, invariance/interpretability to detect adversarial samples, e.g., [8]}, [9]}, [10]}, [11]}, [12]} and theoretical studies of adversarially robust learning, e.g., [13]}, [14]}, [15]}. In particular, some studies [16]}, [17]} showed that adversarial training leads to a worse generalization performance, while [18]}, [19]}, [20]} argued that the adversarial robustness requires more (labeled/unlabeled) data to enhance generalization performance. In addition, the trade-off between standard performance and adversarial performance is carefully characterized in [21]}, [22]}.
